Desktop Application Vulnerability in Anthropic’s Claude Software
CVE-2026-88066

7.5HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
3 November 2026

What is CVE-2026-88066?

Anthropic's Claude Desktop is susceptible to a security flaw where the application calls git.exe using an unsafe method, allowing an attacker to leverage Windows' search-path resolution mechanism. If a user opens a project in a directory containing a malicious git executable, the compromised version can be executed with the user’s privileges, posing a significant security risk. This vulnerability has been addressed in the latest release, version 1.8089.0, and users are encouraged to update immediately.

Affected Version(s)

claude-code < 1.8089.0

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.